npm, pnpm, Yarn and Bun

Registry URL	https://packages.vulnetix.com/npm/
Ecosystem ID	npm
Plan	Add-on
Mode	filter: blocked and cooldown versions are removed from the packument
Cooldown	yes, from the packument’s time map
Default mirror	https://registry.npmjs.org

Automatic setup

vulnetix package-firewall npm

File	Read by
~/.npmrc	npm, pnpm, Bun, Yarn Classic (v1)
~/.yarnrc.yml	Yarn Berry (v2 and later), which ignores .npmrc

~/.npmrc gets a managed block:

# Vulnetix Package Firewall
registry=https://packages.vulnetix.com/npm/
//packages.vulnetix.com/npm/:_auth=BASE64_OF_ORGUUID_COLON_APIKEY
# End Vulnetix Package Firewall

~/.yarnrc.yml gets:

npmRegistryServer: "https://packages.vulnetix.com/npm/"
npmRegistries:
  "//packages.vulnetix.com/npm/":
    npmAlwaysAuth: true
    npmAuthIdent: "YOUR_ORG_UUID:YOUR_API_KEY"

To build _auth by hand, see Authentication. For a single project, put the same lines in the project’s .npmrc or .yarnrc.yml.

Use and verify

npm config get registry
npm cache clean --force
npm install lodash

Notes

• Scoped packages use the default registry. A @scope:registry= line in any .npmrc sends that scope elsewhere and around the firewall.
• npm fetches tarballs from the registry origin without the /npm path. The firewall routes those root .tgz requests to the npm handler, so they are checked the same way.
• A lockfile that pins a blocked version fails at the tarball fetch with the block status. Update the lockfile to an allowed version.
• An allow entry that covers every version, such as @acme/* or @acme/widget with version *, turns the cooldown off for those packages, so a fresh @acme release installs at once. An entry for one exact version does not. See Allow and deny lists.